PDPA and Employee Data: What HR Must Get Right

Admin Loy · · workplace
PDPA and Employee Data: What HR Must Get Right

HR holds more personal data than any other team. Here are the PDPA principles that matter for HR: legal bases, sensitive data, employee rights and a starter checklist.

A department head asks for copies of every team member's ID card and keeps them in a personal drive. Another team shares the company-wide salary spreadsheet in a group chat. And the archive room still holds application files from years ago that nobody knows how long to keep. These situations are common in Thai organisations, and they are risk points under personal data protection law. This article summarises the principles HR should know. It is general information, not legal advice.

What the PDPA is and why it matters for HR

The PDPA is the Personal Data Protection Act B.E. 2562 (2019). It sets duties for anyone who collects, uses or discloses personal data, and rights for data subjects. In employment, the company is the data controller, while employees, applicants and former employees are data subjects. HR holds more personal data than any other team, from applications and salaries to bank accounts and performance reviews.

Legal bases: not everything needs consent

The Thai SEC's PDPA summary explains that Section 24 sets several bases for processing general personal data, such as consent, contract, legal obligation and legitimate interest. Practical HR examples:

A common mistake is asking employees to sign consent for everything, when many uses already have another basis, and consent tied to getting the job is often not truly free consent.

Sensitive data needs extra care

Section 26 defines sensitive data; the SEC document gives examples such as racial or ethnic origin, political opinions, religious beliefs and biometric data. This data may be used only under narrower conditions, such as explicit consent or legal requirements. In HR, review:

HR's main duties as data custodian

Provide a privacy notice

Tell employees and applicants what data you collect, why, how long you keep it, who it is shared with and what rights they have.

Keep data secure

Limit access by role, stop sending salary files in group chats, and have a way to delete or destroy data once it is no longer needed.

Report breaches

The SEC document states that a breach must be reported to the Office of the Personal Data Protection Commission within 72 hours. HR should know exactly whom to alert the moment a file leaks.

Systems and outside providers

If you use a cloud HR system, a payroll outsourcer or a group insurer, employee data leaves the organisation. Have a data handling agreement with each provider, check they can access only the data they need, and know where the data is stored. See guidance on choosing systems in Essential HR tech stack.

Employee rights HR must support

Employees have rights such as access to their data, correction, objection and, in some cases, erasure. Set up a clear channel for requests and name who is responsible for replying.

Collect only what you need, use it as you said you would, and know where it lives.

How to start

  1. List the employee data you hold: where it is stored, who can access it and what basis applies
  2. Remove unnecessary fields from application and HR forms
  3. Write or review privacy notices for employees and applicants
  4. Set retention periods for documents and how to destroy them
  5. Rehearse a data leak response with your IT team

The legal points in this article are based on the PDPA summary by the Thai SEC. For how this applies in your organisation, consult a legal professional. Read more about applicant data in PDPA and candidate data and Background checks and the PDPA.